CVE-2024-23676 Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command
Low-privileged users can view unauthorized index metrics via the mrollup command, requiring high-privileged user interaction to exploit.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-23676?
CVE-2024-23676 is a medium-severity vulnerability in Splunk Splunk, published on 22 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
Weakness: CWE-20
Which versions are affected by CVE-2024-23676?
It affects 2 products.
Products include Splunk Cloud, Splunk Splunk.
How do I fix CVE-2024-23676?
No fix has been published for CVE-2024-23676 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-23676 being exploited?
There is no known exploitation of CVE-2024-23676 in the wild and no public exploit code.
Other vulnerabilities in Splunk Splunk
- CVE-2023-46214 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
- CVE-2024-36982 Denial of Service through null pointer reference in “cluster/config” REST endpoint
- CVE-2024-36989 Low-privileged user could create notifications in Splunk Web Bulletin Messages
- CVE-2024-23675 Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion
- CVE-2024-36986 Risky command safeguards bypass through Search ID query in Analytics Workspace
Sources
Also known as GHSA-6g54-284w-pj4p.